A healthcare ransomware incident is not a data centre problem — it is a patient care problem. The sequencing of clinical system recovery determines whether a hospital can continue to care for patients during recovery, and whether the gap between encryption and restoration costs lives, not just money.
The Gentelman ransomware surge this week, which has disproportionately targeted healthcare providers, makes the clinical recovery prioritisation plan a necessary document for any healthcare security team to have current and tested.
Why Healthcare Recovery Sequencing Is Uniquely Complex
General enterprise ransomware recovery typically prioritises by business impact: restore revenue-generating systems first, then productivity systems, then supporting infrastructure. Healthcare recovery prioritises by patient safety: restore the systems that prevent patient harm first, regardless of their relationship to revenue.
The clinical dependency chain — the sequence of systems that must be operational for a specific clinical workflow — is the primary driver of healthcare recovery sequencing:
Example: Emergency department patient flow
- Patient registration/ADT (Admission, Discharge, Transfer) — required to create a patient record
- Electronic health record access — required to view patient history and current orders
- CPOE (Computerised Physician Order Entry) — required to place medication and diagnostic orders
- Pharmacy system — required to dispense medications against orders
- Laboratory information system — required to result lab orders
- Radiology PACS — required to result imaging orders
- Nursing documentation — required to document care delivery
Restoring CPOE without pharmacy integration means physicians can enter orders that pharmacists cannot action. Restoring EHR access without ADT means new patients cannot be registered. Each dependency failure in the chain produces clinical workflow gaps.
Healthcare-Specific Recovery Priority Tiers
Tier 1 — Patient Safety Systems (restore first, within 4–12 hours):
- PACS/radiology (imaging access for critical diagnoses)
- Medication administration and pharmacy dispensing systems
- Clinical decision support and allergy alert systems
- Monitored bed displays (ICU, cardiac monitoring feeds)
- Code response communication systems
These systems directly affect the likelihood of patient harm if unavailable. Downtime procedures (paper-based workarounds) for these systems are the most difficult to sustain safely.
Tier 2 — Core Clinical Operations (restore within 12–48 hours):
- Electronic health records (EHR) full access
- Computerised physician order entry (CPOE)
- Laboratory information systems
- Admission, discharge, and transfer (ADT) systems
- Surgical scheduling and anaesthesia records
Most hospitals can sustain 24–48 hours on paper-based downtime procedures for these systems, albeit with significant operational friction and risk of documentation errors.
Tier 3 — Administrative and Support Systems (restore within 48–96 hours):
- Billing and revenue cycle management
- Staff scheduling and time-tracking
- Non-clinical communication platforms (email, calendaring)
- Supply chain and inventory management
- Financial reporting
These systems affect operations and revenue but do not create immediate patient safety risks.
Downtime Procedure Activation
Ransomware recovery plans that do not include tested downtime procedures are incomplete. Before a ransomware event, each Tier 1 and Tier 2 clinical system should have:
- Printed downtime records: Pre-printed medication administration records (MARs), intake/output forms, and order forms for the most common clinical workflows. Updated quarterly.
- Manual medication reconciliation process: A documented process for pharmacists and nurses to reconcile medications without electronic system support.
- Off-network backup access: Read-only access to recent patient history on an isolated system or printed summaries for current inpatients.
- Communication tree: A physical notification chain for when systems go offline — nurses to charge nurses to department heads to clinical operations to the incident command team.
These procedures should be tested annually, not just documented.
Backup Architecture for Healthcare
The Gentelman ransomware worm module will encrypt network-accessible backup locations. Healthcare backup architecture must include copies that cannot be reached from the production network at the time of an encryption event:
- Immutable object storage: Cloud backup targets with object lock (AWS S3 Object Lock, Azure Immutable Blob Storage) cannot be deleted or modified for the defined retention period, even if ransomware compromises the backup management server
- Air-gapped tape: Weekly or biweekly tape backups stored offline in a location not network-accessible from production systems
- Segregated backup network: Backup infrastructure on a separate VLAN with no production network routing — accessible only through a dedicated backup management path
For Tier 1 clinical systems, the recovery point objective (RPO) — how much data loss is acceptable — should be 4 hours or less. A hospital that loses 4 hours of patient documentation is a very different situation from one that loses 24 hours.
Share this article